Site-to-site IPsec VPN with two FortiGates

[TJNIHAL]

Hi,

I have 2 Fortinet device 60E and 60D. I have been trying to create a VPN tunnel between the device.   I followed this cookbook article https://cookbook.fortinet.com/site-site-ipsec-vpn-two-fortigates-56/ and both my devices are behind the NAT So, I had to change the NAT setting beside I followed every single step mentioned in this article.  In the end tunnel is NOT UP so, I tried to converted the tunnel to custom and disabled NAT-T, then tunnel is UP but traffic is not passing. Not sure where to look for issue. Any guidance highly appreciate. Both devices have v5.6.2 build1486 (GA) firmware.   Thanks.

[JackieTF · Accepted solution]

Hi TJ,

I can think of few things that you might want to check: 1. Traffic not passing from which site to which site? 2. Is there subnet conflict on both end? (mean both site have same local network) 3. check routing: get router info routing-table details x.x.x.x , replace the x.x.x.x with destination address 4. check policy, make sure policy is created for both direction with NAT disabled. 5. Finally, check debug flow and packet sniffer.

Regards, Jackie

[sangomab · Accepted solution]

Hi there, try this,     [size="3"]

diagnose debug disable
diagnose debug reset
diagnose vpn ike gateway clear
diagnose vpn ike log filter name YOUR_VPN_NAME
diagnose debug application ike -1
diagnose debug enable
 [/size]   and send back the logs   di de di to disable diagnose

[emnoc · Accepted solution]

He need's  NAT-T enabled. He should also dump the  show vpn phase1-interface and phase2-interface  details

e.g

show vpn ipsec phase1-interface

show vpn ipsec phase2-interface

[JackieTF · Accepted solution]

Hi TJ,

I can think of few things that you might want to check: 1. Traffic not passing from which site to which site? 2. Is there subnet conflict on both end? (mean both site have same local network) 3. check routing: get router info routing-table details x.x.x.x , replace the x.x.x.x with destination address 4. check policy, make sure policy is created for both direction with NAT disabled. 5. Finally, check debug flow and packet sniffer.

Regards, Jackie

[TJNIHAL]

Hi Jackie, Thanks for your reply,

1. Traffic not passing from which site to which site?

             Traffic not passing from both site 

2. Is there subnet conflict on both end? (mean both site have same local network)

             No, both site has unique subnet. (both site router is behind NAT connected to the Modem with the same subnet 192.168.0.1/24) But both router has different LAN subnet starting 10.x.x.x/24.    3. check routing:

             double checked the routing its perfect.

              get router info routing-table details x.x.x.x , replace the x.x.x.x with destination address

FGT60E # get router info routing-table details 10.1.3.5

Routing entry for 10.1.3.0/24

 Known via "static", distance 10, metric 0, best

 * directly connected, Test_VPN

 

Routing entry for 10.1.3.0/24

 Known via "static", distance 254, metric 0

 directly connected, Null

FGT60D # diag vpn ike gateway flush

 

FGT60D4Q15011598 # get router info routing-table details 10.1.1.5

Routing entry for 10.1.1.0/24

 Known via "static", distance 10, metric 0, best

 * directly connected, Test_VPN

 

Routing entry for 10.1.1.0/24

 Known via "static", distance 254, metric 0

 directly connected, Null

4. check policy, make sure policy is created for both direction with NAT disabled.

       in/out Polices created on both device with NAT disabled 5. Finally, check debug flow and packet sniffer.

      Not sure which cli command you are referring. 

[sw2090]

hm I am not sure if a flow debug will help here...it will only show you where your traffic goes and if it is allowed or not.

You might have more to look at the ipsec debug log. But beware that IPSEC debugging is a pain in the a*** :(

Basically: 

1st pitfall: vpn tunnels on fgt do not come up if there is no policy for traffic on them.

if that is not the case mostly some settings of your tunnel do not match both sides. Mostly that is proposals, psk or peer ids (if used). You might see this in the ipsec debug log.

To see this use:

  diag debug ena

  diag debug application ike -1

then watch and see...

[sangomab · Accepted solution]

Hi there, try this,     [size="3"]

diagnose debug disable
diagnose debug reset
diagnose vpn ike gateway clear
diagnose vpn ike log filter name YOUR_VPN_NAME
diagnose debug application ike -1
diagnose debug enable
 [/size]   and send back the logs   di de di to disable diagnose

[sw2090]

unfortunately most of the log fiters are broken in fortios and don't work at all. Fortinet know this but don't fix it at least in 5.4.

[TJNIHAL]

Hi thanks for the commands, Please check this make sense to you.

----------------------------------------

diag debug enable   FGT60D # ike shrank heap by 131072 bytes ike 0:Test_VPN: link is idle 6 192.168.4.4->183.82.35.75:0 dpd=2 seqno=df ike 0:Test_VPN:679: send IKEv1 DPD probe, seqno 223 ike 0:Test_VPN:679: enc E6272E2A05661537E6F8D76FC367D030081005013A87C4D0000000540B00001874DC4CCCD65DB4480F68A2F78FBC93C253D44FDE000000200000000101108D28E6272E2A05661537E6F8D76FC367D030000000DF ike 0:Test_VPN:679: out E6272E2A05661537E6F8D76FC367D030081005013A87C4D00000005CCD06F83E36FA847C7F31E8823C8FF4C397B089145F7D032995655A4F4900BF27D708F74CB5E5E8F5EEBB27834EBDF35B8A3D986E2AAD153E07A7F15CC5C90330 ike 0:Test_VPN:679: sent IKE msg (R-U-THERE): 192.168.4.4:500->183.82.35.75:500, len=92, id=e6272e2a05661537/e6f8d76fc367d030:3a87c4d0 ike 0: comes 183.82.35.75:500->192.168.4.4:500,ifindex=6.... ike 0: IKEv1 exchange=Informational id=e6272e2a05661537/e6f8d76fc367d030:43fd8fbb len=92 ike 0: in E6272E2A05661537E6F8D76FC367D0300810050143FD8FBB0000005CF786885A82B37E1BB237FDDFC53102E30A92DA1BEAEE899307735CCEBAC68368BE7B045A1CB11C4C2D0CB30C33991949A81F31B8415A560C6F2537D4FD61674A ike 0:Test_VPN:679: dec E6272E2A05661537E6F8D76FC367D0300810050143FD8FBB0000005C0B0000187F107F0D5529BC3365AD5B9DDC9F2D58C1E2DC42000000200000000101108D29E6272E2A05661537E6F8D76FC367D030000000DF5EB323D520DDDE07 ike 0:Test_VPN:679: notify msg received: R-U-THERE-ACK ike 0: comes 183.82.35.75:500->192.168.4.4:500,ifindex=6.... ike 0: IKEv1 exchange=Informational id=e6272e2a05661537/e6f8d76fc367d030:d3a32643 len=92 ike 0: in E6272E2A05661537E6F8D76FC367D03008100501D3A326430000005C125AD2D18FAFB7A105C930DDE0086529C2E20FDF70CCA4F67561F6AFF1981188B73514199AAB493FDD3B9EF0D7B844DD5E417FC77E32E9B59E22455AA5CA722C ike 0:Test_VPN:679: dec E6272E2A05661537E6F8D76FC367D03008100501D3A326430000005C0B0000182293792A189E914EE4B9A136FBB11B19F9AA3BC6000000200000000101108D28E6272E2A05661537E6F8D76FC367D0300000001E5ABA5CCAF18E3607 ike 0:Test_VPN:679: notify msg received: R-U-THERE ike 0:Test_VPN:679: enc E6272E2A05661537E6F8D76FC367D030081005018C5CE85E000000540B0000180E58674B905AEA2F62ED694CBA019217B607154F000000200000000101108D29E6272E2A05661537E6F8D76FC367D0300000001E ike 0:Test_VPN:679: out E6272E2A05661537E6F8D76FC367D030081005018C5CE85E0000005CBF7C3A08C9C9A5095554B3010EBB8EC16B27379692E20BB7AAAC777EB56F3DF96BCBAB3941D73D863758FA7264C21D3394E3B999E56656E993103DC175CCEDD8 ike 0:Test_VPN:679: sent IKE msg (R-U-THERE-ACK): 192.168.4.4:500->183.82.35.75:500, len=92, id=e6272e2a05661537/e6f8d76fc367d030:8c5ce85e ike 0: comes 183.82.35.75:500->192.168.4.4:500,ifindex=6.... ike 0: IKEv1 exchange=Informational id=e6272e2a05661537/e6f8d76fc367d030:26748a38 len=92 ike 0: in E6272E2A05661537E6F8D76FC367D0300810050126748A380000005CC173151BAF015CD809A4CBA12CBDF29007148655D67C6FC1675FA76C2320376AB90DF93AC7BE7282F48891806BB7321B62A5DAEFDA8496FBF500963A8D93064E ike 0:Test_VPN:679: dec E6272E2A05661537E6F8D76FC367D0300810050126748A380000005C0B000018CD2A14C68B5EA9AB695C3A23EA2067DD880E660A000000200000000101108D28E6272E2A05661537E6F8D76FC367D0300000001FC26560983CDF8807 ike 0:Test_VPN:679: notify msg received: R-U-THERE ike 0:Test_VPN:679: enc E6272E2A05661537E6F8D76FC367D030081005015081BB09000000540B000018E06B5938BEF1181F78815D0BEF97099E7669D2FC000000200000000101108D29E6272E2A05661537E6F8D76FC367D0300000001F ike 0:Test_VPN:679: out E6272E2A05661537E6F8D76FC367D030081005015081BB090000005C07ACDA2B5550497E0A2478A7415CD6239099E8300ED811E75F58BBB1D5642AD48A46C2E4BEC809C84CC8C2F22A22EAB30D86252B78FF6F171C9DF24609D48972 ike 0:Test_VPN:679: sent IKE msg (R-U-THERE-ACK): 192.168.4.4:500->183.82.35.75:500, len=92, id=e6272e2a05661537/e6f8d76fc367d030:5081bb09 ike 0: comes 183.82.35.75:500->192.168.4.4:500,ifindex=6.... ike 0: IKEv1 exchange=Informational id=e6272e2a05661537/e6f8d76fc367d030:2a748d1f len=92 ike 0: in E6272E2A05661537E6F8D76FC367D030081005012A748D1F0000005C9AEB7C7B09CFB68A903469F7754700EF948B30296C928FB3E991FA14AB0A222461161712408CD612AE7F0ADCB327BC81A8FDCB90149FCF2E3358EBA30946A2EF ike 0:Test_VPN:679: dec E6272E2A05661537E6F8D76FC367D030081005012A748D1F0000005C0B0000186CDC85941D382A3EF1B85AD5FDA9514D0F7EDCD5000000200000000101108D28E6272E2A05661537E6F8D76FC367D03000000020F2CDF04F8FEC0607 ike 0:Test_VPN:679: notify msg received: R-U-THERE ike 0:Test_VPN:679: enc E6272E2A05661537E6F8D76FC367D030081005010F5F75B0000000540B00001821B8949646A899DF6940806F4CFDC90DE2A99C00000000200000000101108D29E6272E2A05661537E6F8D76FC367D03000000020 ike 0:Test_VPN:679: out E6272E2A05661537E6F8D76FC367D030081005010F5F75B00000005CB72F1FBCC335B629968C91B524B73186777FE779D733690275C18B51C60214214B7646B6DA3FED664413B3D38A75F1B3401692955F973E4B800D35A580C648FB ike 0:Test_VPN:679: sent IKE msg (R-U-THERE-ACK): 192.168.4.4:500->183.82.35.75:500, len=92, id=e6272e2a05661537/e6f8d76fc367d030:0f5f75b0 ike 0: comes 183.82.35.75:500->192.168.4.4:500,ifindex=6.... ike 0: IKEv1 exchange=Informational id=e6272e2a05661537/e6f8d76fc367d030:18aad778 len=92 ike 0: in E6272E2A05661537E6F8D76FC367D0300810050118AAD7780000005CE4CA776982D051DCD36A29B20FE7262EE371A4DC57C0B58DDF2CBE7F15822C1209FE0601A4ACB437CC91BF91C2D71560FD52B997D4D6462EFF2D161A3A41C250 ike 0:Test_VPN:679: dec E6272E2A05661537E6F8D76FC367D0300810050118AAD7780000005C0B000018600B7EF11D7F112951555F9DDF841BB49DBE819F000000200000000101108D28E6272E2A05661537E6F8D76FC367D030000000216DB8263649133507 ike 0:Test_VPN:679: notify msg received: R-U-THERE ike 0:Test_VPN:679: enc E6272E2A05661537E6F8D76FC367D030081005012E60CC06000000540B000018C67FF351F885DEFB44F14487AEC86EC7721AEC73000000200000000101108D29E6272E2A05661537E6F8D76FC367D03000000021 ike 0:Test_VPN:679: out E6272E2A05661537E6F8D76FC367D030081005012E60CC060000005CA885CA88C8D12530F1D52E0319C96D9CD1CBAF62E61D5CE901B14FD0DE2C09844A8059ECCC3DA88F4ADA633414841B3DC7B2A0F968D0EBC3645E01F0765F48BF ike 0:Test_VPN:679: sent IKE msg (R-U-THERE-ACK): 192.168.4.4:500->183.82.35.75:500, len=92, id=e6272e2a05661537/e6f8d76fc367d030:2e60cc06 Timeout exit

Thanks

[sw2090]

hm looking at your log I'd say your tunnel is indeed up. It is sending and replying ike keepalive (R-U-THERE) packets.

Maybe you are missing policies and/or routing?

[emnoc · Accepted solution]

He need's  NAT-T enabled. He should also dump the  show vpn phase1-interface and phase2-interface  details

e.g

show vpn ipsec phase1-interface

show vpn ipsec phase2-interface

[TJNIHAL]

Hi emnoc,

If I enable NAT-T VPN disconnect, VPN is up with only NAT-T at disabled state.

I have run the given command please check

Site A ------------------------------------------------------------------------------------- edit "Test_VPN" --More--                  set interface "wan1" --More--                  set keylife 28800 --More--                  set peertype any --More--                  set proposal aes256-sha1 --More--                  set comments "VPN: Test_VPN (Created by VPN wizard)" --More--                  set nattraversal disable --More--                  set remote-gw 122.165.133.123 --More--                  set psksecret ENC FJRWHaVsAineL6wDwsNpLbS5kvgWB37sYoy8wTAruzGkNK1fBnFExcMPohmIxKz6yDYBn1jLO9xADZAlD9NNKLiifwKu2b2o1gJhNY9QyTDNao6MZkpXVG8w8HGIQwjV3CeT8UTSN/TcAmln65gytiqh8mJwJgxNhdoHbczfS3SAiNR3cYeKtTaPvAhu8TWz/0fMNw== --More--              next --More--          end edit "Test_VPN" --More--                  set phase1name "Test_VPN" --More--                  set proposal aes256-sha1 --More--                  set pfs disable --More--                  set replay disable --More--                  set auto-negotiate enable --More--                  set comments "VPN: Test_VPN (Created by VPN wizard)" --More--                  set keylifeseconds 3600 --More--                  set src-subnet 10.1.1.0 255.255.255.0 --More--                  set dst-subnet 10.1.3.0 255.255.255.0 --More--              next --More--          end edit "Test_VPN" --More--                  set interface "wan2" --More--                  set keylife 28800 --More--                  set peertype any --More--                  set proposal aes256-sha1 --More--                  set comments "VPN: Test_VPN (Created by VPN wizard)" --More--                  set nattraversal disable --More--                  set remote-gw 183.82.35.75 --More--                  set psksecret ENC dRtvDGWEcCfKL8uVMk/A9zHy2D/3Byy39uDvxjaX7TdFtmJkSKT5x56Yl7ayIFIjh8bZPxywRebgrAebD5A4ATeLqTGw0iYyUdgkgip1CVnUzj36AGTeawUEq/P6Yff3BrVj3mX2hMldUff0UAqmmucD9FKw/ORV09w4VfJgVvsmzq0TeOF6sNls9HLzCETkTGHbcA== --More--              next --More--          end

Site B  ------------------------------------------------------------------------------------------- edit "Test_VPN" --More--                  set phase1name "Test_VPN" --More--                  set proposal aes256-sha1 --More--                  set pfs disable --More--                  set replay disable --More--                  set auto-negotiate enable --More--                  set comments "VPN: Test_VPN (Created by VPN wizard)" --More--                  set keylifeseconds 3600 --More--                  set src-subnet 10.1.3.0 255.255.255.0 --More--                  set dst-subnet 10.1.1.0 255.255.255.0 --More--              next --More--          end